This vulnerability, identified as CWE-98, arises from improper control of filenames in include or require statements within the PHP code of ThemeREX Skyward. The flaw allows unauthenticated attackers to perform local file inclusion, which can lead to remote code execution or other severe impacts. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. The affected versions are Skyward versions up to and including 1.10. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification or deletion of data, and disruption of service. The unauthenticated nature of the vulnerability increases its risk, although the attack complexity is high. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application, applying web application firewall rules to detect and block suspicious include/require requests, and monitoring for unusual file access patterns. Avoid exposing the vulnerable application to untrusted networks if possible.